RCE in Cudy Tr1200
CVE-2026-4537
A vulnerability was determined in Cudy TR1200 R46-2.4.15-20250721-164017. Impacted is the function action_ipsec_conn of the file /usr/bin/lib/lua/luci/controller/ipsec.lua. Executing a manipulation can lead to command injection. The attack…
EPSS: 0.003 (56.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Cudy Tr1200 — versions R46-2.4.15-20250721-164017
Weakness classification (CWE)
References
- VDB-352325 | Cudy TR1200 ipsec.lua action_ipsec_conn command injection (technical-description, vdb-entry)
- VDB-352325 | CTI Indicators (IOB, IOC, TTP, IOA) (signature, permissions-required)
- Submit #774447 | cudy AC1200 Wi-Fi Mini VPN Router TR1200 1.0 TR1200-R46-2.4.15-20250721-164017-flash.zip Command Injection (third-party-advisory)
- cna@vuldb.com (exploit)
Frequently asked questions
- What is CVE-2026-4537?
- CVE-2026-4537 is a medium-severity vulnerability in Cudy Tr1200, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 4.7/10. Published 2026-03-22.
- How severe is CVE-2026-4537?
- Medium severity. CVSS v3 base score is 4.7 out of 10.